MEMORANDUM

TO: Cora Marrett, Senior Vice President, Academic Affairs

Deborah Durcan, Vice President of Finance
Patricia Brady, General Counsel
Larry Rubin, Assistant Vice President of Academic and Student Services
Kristen Hendrickson, Budget and Policy Analyst

FROM: Christopher Ashley, System Legal Counsel

DATE: June 4, 2020

RE: E-Signatures in University Transactions

As you are aware, university business is increasingly being done on-line in a variety of contexts.
For example, students can access their educational information, register for classes, apply for
financial aid and receive information about financial aid disbursements on-line. I understand that
institutions are considering sending grades and billing statements electronically as well. Moreover,
under a Department of Education initiative, borrowers and lenders in federal student loan programs
now may use electronic promissory notes and electronic signatures in place of paper documents and
pen-and-ink signatures. In addition, the Department of Education recently proposed regulations that
would allow students to consent in electronic format to an institution’s release of records protected
by the Family and Educational Rights and Privacy Act (FERPA).

All of these transactions are subject to the federal Electronic Signatures in Global and National
Commerce Act (E-Sign Act), 15 U.S.C. § 7001 et seq. This memorandum summarizes the
provisions of that law as they would apply to various transactions currently or expected to be done
electronically. As discussed below, the legal landscape in Wisconsin is clouded somewhat by
uncertainty about the interplay between the E-Sign Act and a state law relating to e-signatures that
predates the E-Sign Act. In my opinion, however, the federal law pre-empts the state law as applied
to on-line transactions originating or terminating in Wisconsin. System institutions therefore should
ensure compliance with the requirements of the federal statute for all transactions using an
electronic signature.
 Summary of E-Sign Act

1. Validation of E-Signatures and Retention of Records in Electronic Form

The primary purpose of the E-Sign Act is to validate the use of electronic signatures, contracts and
records by giving them the same legal effect as if they were conducted in paper form. The E-Sign
Act does not change the substantive requirements for a legally enforceable contract or other
transaction. Nor does it require a party to use or accept electronic signatures or documents. It
simply affirms that contracts or other records relating to a transaction may not be denied legal effect
because an electronic signature is used in its formation.

Similarly, the Act validates the use of electronic records for satisfying record retention requirements
imposed under other laws. The Act requires an electronic record to be kept in a form that is capable
of accurately reproducing the information required to be retained, and to be accessible to all parties
entitled by law to access the record. Federal and state regulatory agencies are authorized to
establish performance standards for compliance with particular record retention requirements, but
they cannot require specific technology unless doing so serves important government objectives.

2. What is a Valid Electronic Signature? 1

Under the E-Sign Act, an “electronic signature” is broadly defined as any symbol, sign or process,
attached to or logically associated with an electronic record and made with the intent to sign the
electronic record. Examples of electronic signatures that meet the E-Sign Act requirements include:

 A name typed at the end of an e-mail message by the sender;

 A digitized image (e.g., a JPEG file) of a handwritten signature;
 A biometric identifier (e.g., fingerprint or voiceprint);
 A code or personal identification number;
 A digital signature in a public key cryptography system; or
 A mouse click on an “I accept” button.

It is important to recognize that a valid e-signature on a document does not of itself establish the
trustworthiness of the document. Because a student, for example, could easily type his roommate’s
name on a document, or might even know his roommate’s password or PIN number, any procedures
for using and accepting e-signatures must have independent mechanisms for establishing the
trustworthiness of the document. From a legal perspective, this requires the following:

 Authentication – Is the person signing the document in fact the person identified?
 Attribution/Non-repudiation – Can the parties prove, if necessary, that the sender of the
document intended to be bound by the terms of the document?
 Integrity – Is the document the recipient received the same as the document the sender sent?
 Confidentiality – Is the document protected from access by unauthorized persons?

i. Authentication
1
A “digital signature” is not synonymous with “electronic signature.” “Electronic or e-signature” is the generic term.
A “digital signature” is a specific type of e-signature based on a particular authentication technology called public key
infrastructure, a cryptography system.

2
There are a variety of methods for ensuring that the person at the other end of the transaction is who
they say they are. Among the most common systems are shared secrets (e.g., mother’s maiden
name), use of so-called trusted third parties (e.g., Verisign), replies and acknowledgements (e.g., a
return e-mail to the user’s address) and data matching (i.e., checking personal data provided by the
user against an independent source).

If an institution uses a PIN, password or other “shared secret” system, as some System institutions
do, the process should include an express agreement by the consumer that the PIN, password or
shared secret will not be disclosed to others, and a procedure the consumer can use to notify the
institution if the shared secret has been compromised. The institution must have adequate security
measures to protect against disclosure of the information to unauthorized parties.

I understand that for some transactions, a few System institutions use a digital signature system
based on public key infrastructure (PKI) technology. Under this approach, a “trusted third party,”
such as Verisign, delivers a “client certificate” or digital identification to the consumer that is used
to identify the consumer (actually the consumer’s computer) and sign the document.2 With this
method of authentication, it is likewise important to assure that the customer’s certificate is not used
without authorization. This could be in the form of an agreement from the consumer not to disclose
the secure access procedure for the transaction or transfer any hardware device used in connection
with the certificate to an unauthorized user.

Digital signature systems have clear benefits in their added security, but they may be costly to
implement. UW System recently entered into a System-wide contract with a distributor of Verisign
software that will allow campus administrators to purchase digital certificates at a discounted rate. I
believe the CIOs are evaluating whether PKI may be implemented more broadly and more
economically throughout the System.

ii. Attribution

Attribution involves the means for establishing that the consumer intended to apply an electronic
signature to a document, and thereby be bound by it. This is commonly done through “click-
through” dialog boxes that appear during the transaction alerting the consumer that the process will
result in an enforceable electronic signature being applied to or associated with the document. A
pop-up notice that says, in effect, “are you sure you want to sign and send this document?” affirms
the consumer’s intent to be bound by electronic document in the same way signing a letter, placing
it in an envelope, and mailing it affirms his or her intent to be bound by a paper document.

iii. Confidentiality & Integrity

Parties to an electronic transaction must be reasonably sure that the document received by the
recipient is the same as what is sent by the sender, i.e., that the document has not been altered in

2
One way to see an example of how a digital signature process works is to try to send an encrypted e-mail using a
UWSA Netscape e-mail account. If you compose a message and click on the small padlock icon at the bottom of the
page, Netscape will take you to a menu that instructs you how to obtain the digital certificates necessary to send and
receive encrypted e-mail messages.

3
transmission or storage. A related requirement is that electronic documents are secure from
unauthorized disclosure, especially if the document contains personal information.

Electronic transactions using the simplest forms of e-signature, such as clicking on an “I agree”
button, or PINs, are less secure against unauthorized access and alteration than are transactions
systems using encryption technology, such as PKI-based systems discussed above. As a result,
businesses seeking stronger protection typically rely on encryption to protect the confidentiality and
integrity of electronic records and documents.

3. Consent Requirements

The E-Sign Act requires that before engaging in an electronic transaction, the institution must
obtain the consumer’s consent to receive electronic records in connection with the transaction.
Consent applies only to a particular transaction. The consumer may elect to receive paper records
relating to other transactions.

Before obtaining consent, the institution must disclose the following information to the consumer:

 Any option the consumer has to conduct the transaction in paper form;
 The consumer’s right to have relevant documents provided or made available in paper form;
 His or her right to withdraw consent to and electronic transaction and a procedure for doing
so;
 A summary of the consequences of withdrawing his or her consent to electronic
transactions;
 The scope of the consent, i.e., what transactions the consent extends to;
 The procedure for obtaining paper copies of electronic records; and
 The hardware and software requirements for access to, and printing and retention of
electronic records used in the transaction.

In addition, before initiating an electronic transaction, the institution must obtain verification from
the consumer, such as via return e-mail, that the consumer is able to access the electronic record in
the specified format. Consumers may not consent to an electronic transaction through an oral
communication.

II. Relationship Between the E-Sign Act and the Wisconsin E-Signature Law

The Wisconsin Electronic Signatures Act, § 137.06, Stats., which pre-dates the E-Sign Act by three
years, imposes more stringent requirements on what constitutes a legally enforceable electronic
signature in Wisconsin. It must be:

 Unique to the person using it, e.g., a digital copy of a handwritten signature
 Capable of verification of the identity of the signer;
 Under the sole control of the person using it; and
 Linked to the document to which it is attached in a way that if the document is altered after
the electronic signature is created, the electronic signature becomes invalid.

4
However, in my opinion, these provisions are pre-empted by the E-Sign Act which precludes states
from enacting anything other than “technology-neutral” e-signature requirements. In particular, the
E-Sign Act supersedes any state statute that accords greater legal status or effect to specific
technology or technical specification for e-signatures. Since the requirements of § 137.06 can be
met only by some form of digital signature (PKI) technology, the E-Sign Act controls, at least as
applied to transactions “in or affecting interstate or foreign commerce.”

Moreover, it is safe to act on the assumption that all transactions between System institutions and
students, even if the student is in Wisconsin at the time of the transaction, will nevertheless be
considered “interstate commerce” for purposes of the E-Sign Act. As a practical matter, the packet-
switching technology on which the Internet is based results in messages from one party in
Wisconsin to be routed to servers outside the state before reaching a Wisconsin recipient. Legally,
this is sufficient to constitute transmission in interstate commerce. Furthermore, the transactions for
which System institutions are contemplating using electronic signatures “affect” interstate
commerce even in the case of a communication between two Wisconsin parties that remained
entirely within the state during the course of its transmission.

In recent legislative sessions, the Department of Administration has proposed amending

Wisconsin’s e-signature provisions by adopting the Uniform Electronic Transactions Act (UETA), a
uniform law that has been enacted in 40 states. The E-Sign Act deems state legislation based on
UETA to be consistent with E-Sign and therefore free from the preemption issues discussed above.
To date, the Wisconsin legislature has not amended or replaced § 137.06.

III. Conclusion and Recommendations

As System institutions contemplate doing more student transactions (and employee transactions, for
that matter) on-line, CIOs, CBOs and other institutional personnel should work together to ensure
that on-line systems afford users the notices and options required by the E-Sign Act.

It would also be productive for System institutions to continue evaluating ways to make on-line
transactions more secure, including adoption of digital signature systems if cost-effective and
appropriate. As indicated by UW System’s recent procurement of digital certificates on a System-
wide basis, System Administration can assist the campuses in implementing cost-effective security
for on-line transactions.

This office would be happy to provide further guidance about how the E-Sign Act applies to
specific activities or transactions.